Prepare canonical custody for audit E2 third attempt

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02991-be07-7bb3-8b6d-e9701b5621de

docs/WH-ENG-20260822-AUDIT-E2-03-custody-contract.json

@@ -0,0 +1,59 @@
+{
+  "interface": "railiance.custody-projection-contract",
+  "version": 1,
+  "workplan_id": "RAILIANCE-WP-0025",
+  "engagement_id": "WH-ENG-20260822-AUDIT-E2-03",
+  "status": "proposed",
+  "engagement_contract_sha256": "3e70e4581ddcfc8dea35ec21e72d3e2cdd7699ee9e9932d8eee97b64b648d5cd",
+  "target": {
+    "id": "audit-core",
+    "namespace": "audit-core",
+    "deployment": "audit-core",
+    "container": "audit-core",
+    "sender_external_secret": "audit-core-senders",
+    "revision": "abd22fa0a64faca4c77752bb500c892d4f075ac5",
+    "image_digest": "sha256:c2fe39a0185b99be3fc0cb14d2de69772b8e66e20490097c9d11d90cc39719a6",
+    "contract_sha256": "5bf926e9da394da28e1d2cb11ead33d6d27a20b40914d8097b1041b35a18696e"
+  },
+  "runner": {
+    "namespace": "whitehat",
+    "service_account": "whitehat-runner",
+    "secret_name": "whitehat-e2-audit-credentials-03",
+    "mount_root": "/var/run/secrets/whitehat",
+    "manifest_sha256": "41201af08df484659f1eb89e19acb8042fc44cd3eeac1369784e8ce9e2166c4a"
+  },
+  "window": {
+    "starts_at": "2026-08-22T22:00:00Z",
+    "projection_cutoff": "2026-08-22T22:03:00Z",
+    "expires_at": "2026-08-22T22:15:00Z"
+  },
+  "authority": {
+    "remote": "railiance01",
+    "registry_path": "platform/workloads/audit-core/senders",
+    "registry_field": "senders.json",
+    "kv_mount": "platform",
+    "kv_prefix": "engagements/WH-ENG-20260822-AUDIT-E2-03/audit-core",
+    "eso_service_account": "external-secrets",
+    "eso_namespace": "external-secrets"
+  },
+  "identities": [
+    {
+      "handle": "token-a",
+      "role": "attacker",
+      "sender_name": "whitehat-e2-a-20260822-03",
+      "tenant": "tenant:trial:whitehat-a-20260822-03",
+      "mount_path": "/var/run/secrets/whitehat/token-a",
+      "may_read": true,
+      "may_write": true
+    },
+    {
+      "handle": "token-b",
+      "role": "owner",
+      "sender_name": "whitehat-e2-b-20260822-03",
+      "tenant": "tenant:trial:whitehat-b-20260822-03",
+      "mount_path": "/var/run/secrets/whitehat/token-b",
+      "may_read": true,
+      "may_write": true
+    }
+  ]
+}